Sr. IT Compliance Analyst / Engineer

Stanley 1913 is looking for a contract Sr. IT Compliance Analyst / Engineer to strengthen and operate our IT governance, risk and compliance program. You will support third-party risk management (TPRM) work with contractors and vendors, test that security controls work as intended, help keep audit evidence current, and own the technical execution of legal holds and eDiscovery searches in Microsoft Purview and Exchange Online. This is a technical, hands-on role - you will configure, query and script, not just review - sitting on the Information Security + GRC team and working closely with Legal, IT and the business, turning policy and regulatory requirements into controls that work in practice., Governance, risk & compliance

· Maintain the IT control framework and map controls to applicable standards (NIST CSF, ISO/IEC 27001, Information Security Forum (ISF) Standard of Good Practice).

· Test that security controls work as designed (e.g., sample evidence that access reviews happened, MFA is enforced, logging is on); document findings and remediation plans.

· Support internal and external audits and assessments by gathering evidence and answering IT audit requests.

· Maintain the IT risk register: identify, assess, track and report risks and exceptions to leadership.

· Draft, review and update security and IT policies, standards and procedures on an annual cycle.

· Support the annual ISF Security Healthcheck: gather evidence, track results and help remediate identified gaps.

· Run the risk exception process: review exception requests, assess the risk and make recommendations, obtain Senior Director sign-off, and present exceptions for approval.

· Build GRC metrics and dashboards for leadership and audit committees.

Third-party risk management (TPRM) support

· Work on TPRM assessments for third-party contractors and vendors across intake, risk tiering, due diligence, onboarding, periodic reassessment and offboarding.

· Review security questionnaires (SIG, CAIQ), SOC 1/SOC 2 reports, ISO certificates, penetration test summaries and bridge letters.

· Identify gaps, define compensating controls and track vendor remediation to closure.

· Partner with Procurement and Legal on security, privacy and data-protection contract terms (DPAs, breach notification, right to audit).

· Maintain the vendor inventory and continuous monitoring signals (e.g., security ratings).

Legal hold & eDiscovery

· Execute litigation holds in Microsoft Purview (eDiscovery Standard/Premium) across Exchange Online, OneDrive, SharePoint and Teams.

· Build and run Content Search / eDiscovery searches using KQL; refine queries to balance precision and recall.

· Export, review and deliver search results to Legal and outside counsel with documented chain of custody.

· Configure and manage retention policies, retention labels and holds; validate that holds are applied and released correctly.

· Use Exchange Online PowerShell and Security & Compliance PowerShell for in-place holds, mailbox searches and reporting.

· Maintain runbooks and an auditable log for every hold and search request.

· Run content searches on terminated employees’ data using AvePoint.

· Work legal hold, search and risk exception requests through Jira service desk tickets, keeping status, approvals and documentation current.

Identity governance, engineering & automation

· Automate evidence collection, control monitoring and reporting with scripting (PowerShell, Python) and GRC tooling.

· Work with IT and Security engineering to embed compliance requirements into system design, change management and access reviews.

· Lead periodic IAM access reviews across all identity types - employees, contractors, vendors/third parties, guest accounts, and service accounts and other non-human identities - using BalkanID (our IGA platform) and Microsoft Entra ID (Access Reviews, PIM); drive removal of orphaned, stale and excessive access and verify joiner-mover-leaver processes.

· Run privileged access attestation and segregation-of-duties checks; confirm service account ownership, credential rotation and least-privilege permissions.

· Build and maintain integrations between BalkanID and HR and SaaS applications (e.g., BambooHR, Legal Tracker) using APIs and service accounts.

· Validate RBAC role definitions and remediate BalkanID IAM Risk Analyzer findings with application owners.

· Hold regular check-ins with application owners and coach them on their BalkanID dashboards and access reviews.

· 5+ years of experience in IT compliance, IT audit, GRC or information security risk management.

· Hands-on experience working within a third-party / vendor risk management program, including SOC 2 report review and security questionnaire assessment.

· Working knowledge of NIST CSF and ISO/IEC 27001; ability to map controls across frameworks.

· Experience executing litigation holds and eDiscovery searches in Microsoft Purview and/or Exchange Online (Content Search, In-Place/Litigation Hold), or equivalent experience with another enterprise eDiscovery or archiving platform.

· Experience testing security controls and gathering evidence for internal or external audits.

· Hands-on Microsoft 365 administration experience (Exchange Online, SharePoint, OneDrive, Teams).

· Hands-on experience with Microsoft Entra ID (Azure AD): conditional access, role-based access control, Privileged Identity Management (PIM), access reviews, and sign-in and audit log analysis.

· Experience planning and running IAM / user access reviews across employees, contractors, vendors, guest accounts and service accounts (non-human identities), including certifying access with business owners and tracking remediation to closure.

· Experience with an IGA platform (BalkanID, SailPoint, Saviynt, etc.), including role-based access control (RBAC) design and access risk remediation.

· Working scripting ability in PowerShell (Exchange Online, Security & Compliance and Microsoft Graph modules) to run searches, pull evidence and automate reporting.

· Experience building or maintaining API-based integrations (REST APIs, service accounts) between identity platforms and HR or SaaS applications.

· Experience working requests in Jira Service Management or another ITSM / service desk tool (e.g., ServiceNow).

· Strong written communication: able to write clear policies, findings and risk summaries for technical and non-technical audiences.

· Sound judgment handling confidential and legally privileged information.

· Bachelor’s degree in Information Systems, Cybersecurity, Computer Science or a related field, or equivalent practical experience., · Experience with the Information Security Forum (ISF) Standard of Good Practice, Security Healthcheck or IRAM2.

· Microsoft Purview eDiscovery (Premium) experience: custodians, review sets, hold notifications and advanced indexing.

· Experience with AvePoint for Microsoft 365 content search, backup or archiving.

· Python or Microsoft Graph API experience for building compliance automation and integrations.

· Experience with OneTrust (Third-Party Risk, GRC or Privacy modules) strongly preferred; other GRC/TPRM platforms (e.g., ServiceNow IRM, Archer, AuditBoard) and security ratings tools (e.g., BitSight, SecurityScorecard) also considered.

· Experience in retail, consumer products or e-commerce environments.

· Certifications (one or more): CISA, CRISC, CISSP, CISM, ISO 27001 Lead Implementer/Auditor, CTPRP, Microsoft SC-400 / SC-401 (Information Protection Administrator).